A missing authorization flaw in the Airano MCP Bridge WordPress plugin allows attackers to bypass configured access controls. The vulnerability enables users to access administrative or restricted functions they should not be permitted to use, effectively granting elevated privileges or unauthorized data exposure. The flaw is a classic broken access control, categorized as CWE‑862, and can result in the compromise of sensitive WordPress site content or configuration settings.

Airano’s Airano MCP Bridge plugin for WordPress, versions up to and including 2.11.0, is affected. Any WordPress installation using these versions of the plugin may be vulnerable, regardless of the site’s user base or administrative settings.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available, suggesting limited public exploitation data. The vulnerability is not listed in CISA KEV. An attacker likely needs to identify a vulnerable endpoint or function within the plugin and exploit it, possibly requiring authentication that is incorrectly restricted. Because no exploit is known to be actively used, the current risk is moderate but should be mitigated promptly.